® 



J 



Europaisches Patentamt 
European Patent Office 
Office europ^en des brevets 



(11) Publication number: 



0 523 908 A2 



© 



EUROPEAN PATENT APPLICATION 



(3<) Application number: 92306284.8 
@ Date of filing: 08.07.92 



0 Int. CIA G06K 9/62 



^ Priority: 19.07.91 US 732558 


0 Applicant: AMERICAN TELEPHONE AND 




TELEGRAPH COMPANY 


® Date of publication of application: 


550 Madison Avenue 


20.01.93 Bulletin 93/03 


New Yoric, NY 1 0022(US) 


(S) Designated Contracting States: 


(§) Inventor: Nelson, Winston Lowell 


DE FR GB IT NL 


24 Erskine Drive 




Morristown, New Jersey 07960(US) 




® Representative: Watts, Christopher Malcolm 




Kelway, Dr. et al 




AT&T (UK) Ltd. 5, Mornington Road 




Woodford Green Essex, IG8 OTU(GB) 



00 

o 
o> 

CO 
CM 
U> 

o. 



0 Method and apparatus foir controlling a system, using signature verification. 



® Forged signatures are discriminated from au- 
thentic signatures in a verification process which 
relies on dynamic signature properties. In an initial- 
ization phase (010) a reference set of authentic sig- 
natures is obtained. A set of dynamical properties 
(140.1, 140.2. 140.3) of the reference signatures is 
computed numerically. The most characteristic sub- 
set of such properties is selected and statistically 
analyzed to obtain a set of parameters for signature 
verification. An entrant signature is subsequently ac- 
cepted or rejected (160, 170) based on its confor- 
mity to the parameters. An accepted signature is 
optionally passed along to a higher-level verification 
process. When a signature is accepted by the 
highest-level verification process, responsive means 
(050) are activated, resulting in the entrant's access 
to a system. 
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Field of the Invention 

This invention relates to the field of pattern 
recognition, and more specifically, to the verifica- 
tion of handwritten, human signatures. 

Art Background 

The automatic verification of a signature is a 
useful way to identify a human being for purposes. 
e.g., of establishing his authority to complete an 
automated transaction, or gain control of a com- 
puter, or gain physical entry to a protected area. 
Signatures are particularly useful for identification 
because each person's signature is highly unique, 
especially if the dynamic properties of the signa- 
ture are considered in addition to the shape of the 
signature. Even if a skilled forger can accurately 
reproduce the shape of a signature, it is unlikely 
that he can reproduce the dynamic properties as 
well. 

Numerous practitioners have addressed the 
problem of signature verification. Some practition- 
ers have concentrated on analysis of the static 
shapes embodied in signatures, whereas other 
practitioners have concentrated on analysis of dy- 
namic properties. For example, a verification meth- 
od that involves analyzing the dynamic properties 
of signatures is described in U.S. Patent No. 
4,901,358. issued to L. Bechet on February 13, 
1990. That patent discloses a verification method 
based on the x and y speed signals of the signa- 
ture. Each speed signal is broken Into standard- 
ized, short segments, and each segment is com- 
pared with a corresponding segment of a pre- 
viously obtained reference signature. In a contrast- 
ing approach, U.S. Patent No. 4,024,500, issued to 
N.M. Herbst, et al. on May 17, 1977, discloses the 
use of the speed signal to separate the signature 
into segments, followed by shape analysis of the 
segments. A third approach is described in our 
European patent application No. 92304115.6. In 
that approach, a model signature is used as a 
reference for shape analysis. The model signature 
is constructed by affine invariant averaging of refer- 
ence signature segments. In a speed-based seg- 
mentation method, each signature to be segmented 
is compared to a selected reference signature 
through the use of dynamic time warping. 

However, when a person's (hereafter, an 
"entrant's") signature is verified according to one 
of the at)ove-described methods, it is compared, 
segment-by-segment, to a reference signature. As 
a consequence, such methods require a relatively 
large amount of information about the reference 
signature to be stored. This requirement is disad- 
vantageous in applications where the relevant refer- 
ence information is to be stored at a remote loca- 



tion where only limited storage means are avail- 
able. For such applications, it is desirable to char- 
acterize the entrant's signature by a set of numeri- 
cal parameters which, although relatively small, still 

5 identifies that person's signature with a high degree 
of confidence. 

Moreover, such a parameter-based technique, 
even if it fails to provide an acceptable confidence 
level, is useful in combination with more complex 

10 techniques (based, e.g., on pattern-matching) which 
offer greater confidence at the cost of greater delay 
or greater information storage requirements. In 
such a combination, the parameter-based tech- 
nique is useful as a coarse sieve for rejecting gross 

75 forgeries or anomalous signatures, without the 
need to invoke the more complex technique. 

A signature verification technique based on nu- 
merical parameters has, in fact, been described. 
U.S. Patent No. 3.699.517, issued to James W. 

20 Dyche on October 17. 1972. describes a technique 
in which sixteen components of a real-time signa- 
ture vector are compared to the corresponding 
mean values computed on a reference set of pre- 
viously obtained sample signatures. If a sufficient 

25 number of the components fall within a predeter- 
mined range of the respective mean values, the 
signature is accepted. 

Although such a technique may offer advanta- 
geously low storage requirements and rapid pro- 

30 cessing, It is still relatively inefrtctent. In that re- 
gard, we have found that a given entrant's signa- 
tures can be dependably verified on the basis of 
fewer than sixteen parameters, particularly when 
the specific selection of parameters is adaptable to 

35 the idiosyncrasies of a given entrants's handwriting. 
Hitherto, practitioners have failed to provide such 
flexibility, and have consequently failed to provide 
a parameter-based signature verification method 
having extremely high efficiency. 

40 

Summary of the Invention 

In one aspect, the invention involves a method 
for controlling access to a system of the kind in 

45 which access is based on signature verification. 
The invention Is typically practiced in a commu- 
nications network, for example, a plurality of bank 
branches, each communicating with a central office 
via telephone lines, or a plurality of workstations 

50 intercommunicating via a local area network. 

In preferred embodiments, an entrant submits 
sample signatures via digitizing means which facili- 
tate the storage of the sample signatures in digital 
form. In an initializing phase, each entrant digitally 

55 records a set of at least two authorized sample 
signatures, here referred to as the "reference set," 
using the digitizing means. In a later, verification 
phase, a person (claiming to be an authorized 
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entrant having earlier recorded sample signatures) 
again digitally records a signature, here referred to 
as an "entrant signature." The verification process 
Involves the calculation of one or more error val- 
ues, hereafter referred to as "entrant errors", which 
represent the degree to which the entrant signature 
differs from the authorized sample signatures. If the 
entrant error is less than (or. alternatively, less than 
or equal to) a certain threshold, responsive means 
are activated, e.g., an electric circuit or logical 
operation is activated, such that the entrant is given 
access to the system. If the requirement is not 
satisfied, the entrant may, optionally, be invited to 
submit one or more additional entrant signatures 
for verification. 

In the initializing phase of the preferred em- 
bodiment, the sample signatures are digitally pror 
cessed, resulting in a set of at least four calculated 
values which are characteristic of the sample sig- 
natures and represent a certain group of spatial 
and dynamic properties, here referred to as 
"measures," of the sample signatures. A number, 
representing the average or most typical such val- 
ue over the set of reference signatures, is cal- 
culated. Such a number is hereafter referred to as 
an "average". The currently preferred such aver- 
age is the statistical mean. A number is also cal- 
culated, which represents the variability of the mea- 
sure over the set of reference signatures. Such a 
number is hereafter referred to as a "deviation". 
The currently preferred such deviation is the statis- 
tical standard deviation. Significantly, and In con- 
trast to the prior art, a subset consisting of the at 
least three measures having the smallest deviations 
over the set of reference signatures Is selected for 
subsequent use in the verification phase. 

As part of the initializing phase of the preferred 
embodiment, the threshold is calculated on the 
basis of information derived from the reference 
signatures. For each reference signature, each of 
the selected measures, evaluated for that signature, 
is compared to the corresponding average over the 
reference set. Such comparison leads to a set of 
calculated errors, one for each reference signature, 
with respect to the reference set. The threshold is 
determined on the basis of those errors, which are 
hereafter referred to as "reference errors". 

The verification phase includes one or more 
stages, typically including a parameter-matching 
stage. In that stage, at least one entrant signature 
is digitally processed to evaluate the selected mea- 
sures with respect to that signature. The entrant 
error is calculated by comparing these measure 
values to the corresponding mean reference val- 
ues. 

Brief Description of the Drawings 



FIG. 1 is a flowchart describing, in schematic 
fashion, the steps according to one embodiment of 
the inventive method. 

FIG. 2 is a flowchart describing, in schematic 
5 fashion, an exemplary sequence of steps leading to 
the determination of a threshold useful in connec- 
tion with the inventive method for rejecting forged 
signatures. 

FIGS. 3 - 6 are bar graphs illustrating the 
10 ability of the invention to discriminate authentic 
signatures from forgeries. 

Detailed Description of a Preferred Embodi- 
ment 

IS 

A system is provided, which is capable of 
offering access to, or withholding access from, a 
human being, here referred to as an "entrant". As 
noted, above, access is contingent upon successful 

20 verification of the entrant's signature. 

If, for example, the system is an automated 
bank teller machine, such access is the ability of 
the entrant to conduct a banking transaction using 
the system. Access is exemplarily provided by 

25 activating an electric circuit which controls the sys- 
tem such that it can conduct a transaction. (Such 
activation of an electic circuit may, e.g., comprise 
setting a digitally stored value, or "flag." in a digital 
memory.) Other forms of "access" that may be 

30 provided by activating an electric circuit will be 
readily apparent, and include, e.g.. deactivation of a 
physical locking mechanism, or setting a digitally 
stored value such that a computer or computer 
terminal will subsequently respond to the entrant's 

35 commands. 

Exemplary digitizing means comprise a 
capacitance-sensing, transductive tablet whk;h 
senses the position (I.e., the horizontal, or x coordi- 
nate and the vertical, or y coordinate) of the tip of a 

40 stylus, and transmits that information to a digital 
storage device (e.g., a digital computer). Prefer- 
ably, such means are also capable of sensing, and 
transmitting data representing, the stylus pressure 
(exemplarily by means of a pressure transducer. in 

45 the stylus). One suitable stylus-tablet inputting ap- 
paratus is described in co-pending U.S. patent ap- 
plication Serial No. 635,086, filed on February 28, 
1990. 

When a user is establishing his authorization as 
50 an entrant, he enters a reference set of at least two 
sample signatures. (The total numt>er of signatures 
in the reference set is denoted by the positive 
integer n.) In fact, it is desirable for him to enter at 
least 5 signatures, and even as many as 10 or 
55 more. Each signature is recorded as a sequence of 
x-y coordinate pairs recorded at a uniform fre- 
quency of, e.g., about 300 points per second. 
Along with the spatial coordinates, a third coordi- 

3 
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nate, pressure p. Is optionatly recorded at the same 
time points. 

Although the recorded data are typically 
smooth, there are occasional gross outliers and 
noisy points which need to be removed (typically, 
less than 1% of the total). These are easily iden- 
tified by their large Euclidean distance from the 
neighboring points. 

According to a currently preferred embodiment, 
a smooth path is then constructed through the 
remaining x and y coordinates for each word in 
each signature. This is preferably done by smooth- 
ing each coordinate separately against time using a 
cubic smoothing spline. 

In a currently preferred embodiment, the 
amount of smoothing is chosen automatically by 
global cross-validation of the integrated Euclidean 
distance between the observed and fitted points. 
Typically very little smoothing is performed, and 
the fitted curves usually come close to interpolating 
the observed sequences. There are three reasons 
for smoothing the signature sequences in this way: 
(1) even though the amount of smoothing is small, 
it tends to eliminate small discontinuities intro- 
duced by measurement error due to the discretiza- 
tion during the recording process, or small move- 
ments during the signing; (2) the cubic spline re- 
presentation turns the sequence into a function that 
can be evaluated at any point t (this is convenient 
for purposes of subsequent steps); and (3) the 
cubic spline has two continuous derivatives, the 
first of which is used in the speed computation. 

If the observed signature sequence is denoted 

by 

Xi. i = 1 N 

measured at time points tj, then the smoothed 
signature S(t) minimizes the criterion 



XllXi - S(ti)||2 + Xj||S//(t)|pdt 



over a suitable Sobolev space of functions, and for 
some value of the smoothing parameter X. The 
solution varies dramatically with the value of the 
smoothing parameter, which has to be supplied. It 
is desirable to use the cross-validated integrated 
Euclidean squared distance 



cv(X) = i;[Xi - sfiy(ti)y 

i=l 



sh)(ti) 

is the value of the smooth curve evaluated at tj; the 

5 subscript (i) indicates that the i-th point itself was 
omitted in the fitting of the curve. This criterion is 
desirable because it recognizes the signal in the 
signature, and selects a value for X such that only 
enough smoothing is performed to eliminate the 

70 small amount of measurement error. 

A time-dependent speed signal is calculated 
for each of the n smoothed sample signatures. It 
should be noted in this regard that appropriate 
speed signals are generated by the exemplary 

75 smoothing method. 

Each of the smoothed signatures may be char- 
acterized by a group of at least four measures 
which are readily calculable from the smoothed 
signature. Each measure is a well-defined math- 

20 ematical property of a sampled signature which is 
potentially useful for identifying the writer of that 
signature because it varies relatively little between 
signatures made by the same writer. Such a mea- 
sure represents spatial and/or dynamic properties 

25 of the signature. It should be noted, however, that 
although a group of relatively invariant measures 
can generally be found for any given writer, the 
same group generally will not work for other writ- 
ers. Instead, different writers generally have dif- 

30 ferent (relatively) invariant measures. From the in- 
dividual measures, averages and deviations, as dis- 
cussed above, are readily calculated as parameters 
which characterize the reference set as a whole. 
One measure is simply the total path length L 

35 of the signature (optionally scaled by the horizontal 
width of the signature), which is readily calculable 
from the stored array corresponding to the sam- 
pled (and smoothed) signature. Another measure is 
the total duration T of the signature, which is cal- 

40 culable as the number of points sampled during the 
recording of the signature, divided by the sampling 
rate. Various other measures are readily calculated 
from the horizontal speed signal Vx. the vertical 
speed signal Vy, the horizontal acceleration signal 

45 dx. and the vertical acceleration signal By. These 
quantities are defined, respectively, as the first 
derivatives, with respect to time, of horizontal and 
vertical position, and the second derivatives, with 
respect to time, of horizontal and vertical position. 

50 As noted, Vx and Vy are calculated by the currently 
preferred smoothing algorithm. The acceleration 
signals ax and ay are also readily calculated by well 
known numerical techniques. 

The path velocity magnitude (speed) v is ex- 

55 pressed in terms of the horizontal and vertical 
speeds by: 



as a criterion for selecting X. Here 
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V = (vj + y^)^ 

The tangential acceleration at is expressed in terms 
of the horizontal and vertical speeds and accelera- 
tions by: 

a, = (Vxax + Vyay)/v . 

The centripetal acceleration ac can be expressed 
as: 

ac = (Vxay - Vyax)/v . 

The magnitude a of the total acceleration Is given 
by: 



a = (a^ + a^)*'^ . 

The time derivative j of acceleration, often re- 
ferred to as "jerk," is also useful in this regard. 
Letting jx and jy represent, respectively, the time 
derivatives of ax and ay , j may be expressed by 

j = (axix + ayjy)/a . 

Each of the quantities v, ac* a^ a, and j is 
readily calculated as a function of time. Using well 
known numerical techniques, the rms value of each 
of these functions over the sampled (and 
smoothed) curve is readily calculated. Such cal- 
culations provide, respectively, the following mea- 
sures: the rms speed V, the rms centripetal accel- 
eration Ac, the rms tangential acceleration At. the 
rms total acceleration A, and the rms jerk J. Addi- 
tionally, the mean value of Vx is readily calculated, 
providing, as a measure, the average horizontal 
speed Vx. Additionally, well known numerical tech- 
niques are readily used to integrate ac over the 
curve, providing, as a measure, the integral, with 
respect to time, of the magnitude of the centripetal 
acceleration, lAc. The above-described measures 
have been found to be useful, in practice. However, 
this list is not exhaustive. Instead, many other 
potentially useful measures will be apparent to the 
skilled practitioner. 

In the initializing phase, a group of measures, 
exemplarily the nine measures described above, is 
calculated. It should be noted in this regard that the 
two main aspects of signature data, namely, shape 
and dynamics, have somewhat complementary 
roles in distinguishing valid signatures from forger- 
ies. That is, the harder a forger tries to copy every 
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detail of a signature's shape, the less likely he is to 
match its dynamics, and vice versa. Therefore the 
parameter-matching stage should include mea- 
sures which tend to differentiate between shape 

5 and dynamics, so that if one aspect is matched, 
the other is mismatched. We have found that for 
the purpose of differentiating between shape and 
dynamics, a particularly useful group of measures 
are those relating to (i.e.. representing, or derived 

10 from) path-tangential and path-normal properties of 
the motion of the stylus tip. Such measures include 
V, Ac. At, A, J, and lAc, described above. Accord- 
ingly, the initializing phase preferably Includes cal- 
culating at least one such measure. 

15 As noted, an important limitation on the mea- 

sures used is that their variability should be small 
over the reference set of signatures. In order to 
reduce the likelihood of false rejection of valid 
signatures. Since each signature has its own char- 

20 acteristics, which slowly vary over time, measures 
are preferably chosen according to each individ- 
ual's reference set of signatures, and that choice 
preferably evolves as the reference set changes 
over time. 

25 According to a currentiy preferred embodiment, 

the nine measures described above are evaluated 
for each signature in the entrant's reference set. A 
subset of the nine measures, comprising those 
measures having the smallest standard deviations 

30 (when each is normalized to the corresponding 
mean) is selected as the measure space for that 
entrant. Preferably, at least three measures are 
selected. 

With regard to the verification phase, suppose 
35 an entrant signature is submitted by entrant i. Let 
Mjj be the value of the j-th measure in the subset of 
N| measures selected for entrant i. (It should be 
noted that in general, not all of the measures that 
were evaluated for the reference signatures will be 
40 selected for use In the verification phase. Instead, a 
subset will be selected, including, e.g., only those 
measures displaying the smallest standard devi- 
ation over the reference set.) Also, let Uij and oy 
denote the mean and standard deviation, respec- 
45 tively, of Mjj over the current reference set. The 
magnitude, E|, of the error vector in this measure 
space for subject i is usefully defined as 

According to a currentiy preferred screening test, a 
55 cutoff threshold Ci is determined from the refer- 
ence set of entrant i. If E| is less than Ci (or 
alternatively, less than or equal to Q), the entrant 
signature is accepted. Otherwise, the signature is 
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rejected. 

In typical applications, the objective of this 
screening procedure will be to quickly reject crude 
forgeries or errors in signing, but accept, for 
second-stage testing, signatures which may be ei- 
ther valid signatures or skillful forgeries. Accord- 
ingly, the error threshold should lie far enough 
above the largest error in the reference set to 
insure a very tow false rejection rate. 

According to the currently preferred embodi- 
ment, during the intializing phase, the error Ei is 
calculated for each of the reference signatures, 
treating that signature as though it were an entrant 
signature. The greatest of the errors calculated in 
that way (i.e.. the reference errors) is the yardstick 
for establishing the cutoff threshold Cj. That is, Ci is 
set to be equal to the greatest reference error, or it 
is set to some incrementally higher value, such as 
10% above the greatest reference error. 

It should be noted in this regard that during the 
initializing phase, well-known statistical methods 
can be used for recognizing reference signatures 
having anomalous errors. Such anomalies might 
arise, for example, from non-reproduceable errors 
in the entrant's penmanship. Such anomalous sig- 
natures are optionally eliminated from the reference 
set. 

The foregoing discussion is summarized in 
FIG. 1. Means 100 are provided for inputting a 
reference set of signatures, during the initializing 
phase 010. to digital conversion and storage means 
110, which exemplarily comprise a digital central 
processing unit. Analogous (and, for at least some 
applications, identical) inputting means 120 and 
conversion and storage means 130 are provided for 
the entry and storage of at least one entrant signa- 
ture in the verification phase 020. Data represent- 
ing the reference set of signatures are processed 
to obtain a set of dynamical parameters, typically 
the mean and standard deviation over the refer- 
ence set of each of a set of measures. For illustra- 
tive purposes, three such measures. 140.1. 140.2. 
140.3, are represented in the figure. The verifica- 
tion phase includes a parameter-matching stage 
030 and one or more optional second (and higher) 
stages 040. In the parameter-matching stage, the 
stored, digitized entrant signature is subjected to 
digital processing 150. resulting, in the example of 
the figure, in computed values M^, Mia, and Mia, 
corresponding, respectively, to measures 140.1 - 
140.3. Significantly, only selected measures are 
evaluated in this stage. As noted, the index i iden- 
tifies the entrant whose signature Is being verified, 
and the index j here identifies one of the selected 
measures. In processing step 160, an error is cal- 
culated from the parameter values and the 
values. In processing step 170, the error is com- 
pared to a threshold value. If the error exceeds the 
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threshold, the signature is rejected. At this point, a 
new submission of an entrant signature may be 
requested, or the transaction with the entrant may 
simply be terminated. If the signature is accepted. 

5 and if there is only one verification stage, electric 
circuit 050 is activated, making access to a system 
available to the entrant. (For purely illustrative pur- 
poses, such activation is depicted in the figure as 
activation of a relay.) If. as depicted in the figure, 

10 the verification phase has a second stage, the 
stored signature data are subjected to a second 
stage verification process 180 resulting, as before, 
in either rejection, or acceptance and granting of 
access, or acceptance and invocation of a still 

75 higher verification stage. 

Significantly, in the parameter-matching stage 
030, the entrant signature is compared against a 
relatively small amount of data relating to the refer- 
ence set. Such data consist of the identities of the 

20 selected measures, the means (or other averages) 
and standard deviations (or other deviations) of 
those measures over the reference set, and the 
threshold value. As part of the initializing phase, 
those data are conveniently digitally stored at a site 

25 which is local relative to the entrant. Such a site is, 
e.g., associated with a computer terminal or auto- 
matic teller machine through which the entrant con- 
ducts transactions with the access-controlled sys- 
tem. A particularly convenient location for such 

30 storage is a small, portable object such as a credit 
card equipped with a digital data storage medium 
(e.g.. magnetic storage or a solid state microchip 
memory device) and carried by the entrant. 

Accordingly, an embodiment of the invention is 

35 readily envisioned in which the initializing phase 
includes local storage of data, as described. In a 
subsequent, parameter-matching stage, the data 
are entered into the access-controlled system from 
the local data storage medium. 

40 

Example 

The initial database obtained for this study 
included reference sets, of 10 signatures each, 

45 belonging to the four human subjects identified as 
EP, FS, SG, and WN. Forgeries were also obtained 
as follows: of the signature of subject EP, 10 forg- 
eries; of FS, 9; of SG, 4; and of WN. 10. The four 
forgers were volunteers who were shown samples 

50 of the signature they were to imitate, and allowed 
to practice (generally 5-10 minutes) until they felt 
ready to produce the forgery samples. Each forger 
Imitated the signature of one of the four subjects. 
The nine measures described above were eval- 

55 uated on each reference set. and the mean and 
standard deviation of each measure within each set 
were computed. 

It should te noted that to make the parameter- 
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matching procedure automatic, a set of rules is 
needed for selecting the number Nj and set {My} 
of measures to use in computing the error mag- 
nitude Ei for subject i. and for establishing the 
proper threshold Q to obtain the desired low level 
of false rejections. 

With reference to FIG. 2, an exemplary proce- 
dure was established as follows: For each subject, 
the nine measures were rank ordered (step 200 of 
the figure) according to the standard deviation of 
each measure (normalized to the corresponding 
mean) over that subject's reference set. The refer- 
ence error was then repeatedly computed for each 
signature in the reference set, using successively 
larger subsets of the nine rank-ordered measures. 
It was observed that subsets of the best three 
measures would offer only slightly better discrimi- 
nation between valid and forged signatures than 
would subsets of the best two measures. Subsets 
of four measures would offer substantially better 
discrimination. However, when more than four mea- 
sures were considered, the variability over the ref- 
erence set was observed to increase. Therefore, on 
the basis of the existing data, the four top-ranked 
measures were chosen (Step 210). The largest 
reference error was computed (Step 220), and the 
threshold value Ci was arbitrarily set at a value 
10% greater than that value (Step 230 of FIGS. 1 
and 2). This value is readily adjusted in accordance 
with false rejection statistics in a given population. 

The parameter-matching procedure was ap- 
plied to the valid and forged signatures of subjects 
SG, FS. WN, and EP. using the four best measures 
for each in the computation of the entrant errors. 
The results, displayed in FIGS. 3-6, show the 
magnitude of error for the 1 0 valid signatures in the 
left group of bars and the forgeries in the right 
group of each plot. The dotted line is the value of 
Ci for each subject. The four measures chosen for 
each subject are also listed in each plot. 

It is apparent from the figures that the FS (FIG. 
4) and SG (FIG. 3) forgeries could be readily 
discriminated from the valid signature reference 
set The WN (FIG. 5) forgeries were detectable. 
However, the WN reference set displayed enough 
variablilty to suggest that the threshold should be 
set higher than the adopted 10% margin, in order 
to reduce false rejections. Such a change, however, 
would be liable to result in the acceptance, as 
valid, of forgeries only slightly better than those 
that were made. The EP (FIG. 6) forgeries were 
quite skillfully matched to the statistics of the mea- 
sures used, and only 4 out of 10 were rejected. (It 
should be noted that a second-stage verification 
procedure involving more detailed shape analysis 
would be likely to succeed in rejecting such forger- 
ies as survive the parameter-matching procedure.) 
Significantly, the second signature in the EP refer- 



ence set had a substantially larger error than the 
other nine. If that signature were removed from the 
reference set, the threshold would be lowered to a 
level where only one of the forgeries would be 
5 accepted as valid. 

Claims 

1. In a communications network, a method for 
10 controlling access to a system such that when 

an entrant signature is accepted, responsive 
means are activated, with the result that ac- 
cess to the system becomes available, the 
method comprising: 
75 A) in an initializing phase, 

a) receiving from input means, and 
digitally recording, a reference set which 
consists of a multiplicity of reference sig- 
natures: and 

20 b) calculating, for each of at least four 

predetermined spatial and/or dynamic 
signature properties, to be referred to as 
"measures", an average and a deviation 
of that measure over the reference set; 

25 and 

B) in a verification phase, at least a first 
verification stage comprising the steps of: 

c) receiving from input means, and 
digitally recording, at least one entrant 

30 signature; 

d) evaluating at least some of the mea- 
sures on the entrant signature; 

e) calculating an entrant error associated 
with the entrant signature, the entrant 

35 error representing a mismatch between 

at least some of the measures as evalu- 
ated on the entrant signature and the 
same measures as averaged over the 
reference set; and 

40 f) comparing the entrant error to a 

threshold value such that the entrant sig- 
nature is accepted if the entrant error is 
ie$s than, or iess than or equal to, the 
threshold value. CHARACTERIZED IN 

45 THAT 

C) the initializing phase further comprises 
the steps of: 

(g) after step (b), selecting the at least 
three measures having the smallest de- 
50 viations over the reference set; 

h) calculating a reference error associ- 
ated with each reference signature, each 
reference error representing a mismatch 
between the selected measures as evalu- 

55 ated on that reference signature and the 

same measures as averaged over the 
reference set; and 

i) determining the threshold value based 
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on the reference errors; and 
D) the entrant error of step (e) is calculated 
with respect to the selected at least three 
measures. 

The method of claim 1, wherein step (b) com- 
prises calculating at least one measure se- 
lected from the group consisting of: the total 
signature length, the total signature duration, 
the rms speed, the rms centripetal accelera- 
tion, the rms tangential acceleration, the rms 
total acceleration, the rms jerk, the mean value 
of the horizontal speed, and the integral with 
respect to time of the magnitude of the cen- 
tripetal acceleration. 

The method of claim 1 , wherein step (b) com- 
prises calculating at least one measure which 
represents, or is derived from, a path-normal 
or path-tangential property of the reference 
signatures. 

The method of claim 1 , wherein the average of 
each measure over the reference set is the 
statistical mean of that measure over the refer- 
ence set, and the deviation of each measure 
over the reference set is the standard de- 
viation. 

The method of claim 4, wherein: 

a) the step of calculating entrant error com- 
prises evaluating the expression 



Ei = { 2:((Mij-Hy)/aij)2]^ , 

where E| denotes the i-th entrant error, 
denotes the j-th one of the selected mea- 
sures evaluated for the i-th entrant signa- 
ture, Ni denotes the total number of mea- 
sures selected for the i-th entrant, Uy de- 
notes the mean of the j-th measure over the 
i-th reference set, oy denotes the standard 
deviation of the J-th measure over the i-th 
reference set, and the summation is carried 
out over the selected measures; and 
b) the step of calculating reference errors 
comprises treating each reference signa- 
ture, in turn, like an entrant signature and 
calculating the corresponding entrant error. 

6. The method of claim 5, wherein the step of 
determining the threshold value comprises 
identifying the largest reference error, and se- 
lecting a threshold value which is greater than 



or equal to the largest reference error. 

7. The method of claim 1 , wherein: 

a) the initializing phase further comprises 
5 digitally storing, on a storage medium that 

is local with respect to at least one entrant, 
data which comprise: the identities of the 
selected measures, the averages and de- 
viations of the selected measures over the 
10 reference set, and the threshold value; and 

b) the first verification stage further com- 
prises reading the locally stored data. 

a The method of claim 1 , wherein step (b) com- 
15 prises calculating averages and deviations of at 

least five measures, and step (g) comprises 
selecting exactly four measures. 

9. In a communications network, an access-con- 
20 trolled system which includes responsive 

means that are activated when an entrant sig- 
nature is accepted, with the result that access 
to the system is made available, the system 
further comprising: 
25 a) means for receiving and digitally record- 

ing data which represent a reference set 
consisting of a multiplicity of reference sig- 
natures, and for subsequentiy receiving and 
digitally recording data which represent at 
least one entrant signature; 

b) digital processing means for evaluating, 
on each of the reference signatures and the 
entrant signature, at least four predeter- 
mined spatial and/or dynamic properties, to 
be referred to as "measures"; 

c) digital processing means for calculating 
an average and a deviation of each measure 
over the reference set; 

d) digital processing means for calculating 
40 an entrant error associated with the entrant 

signature, the entrant error representing a 
mismatch between at least some of the 
measures as evaluated on the entrant signa- 
ture and the same measures as averaged 
45 over the reference set; and 

e) digital processing means for comparing 
the entrant error to a threshold value such 
that the entrant signature Is accepted if the 
entrant error is fess than, or fess than or 

50 equal to, the threshold value, CHARAC- 

TERIZED IN THAT 

f) the system further comprises digital pro- 
cessing means for selecting the at least 
three measures having the smallest devi- 

55 ations over the reference set; 

g) the entrant-error calculating means are 
adapted to calculate the entrant error with 
respect to the selected at least three mea- 
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sures; 

h) the system further comprises digital pro- 
cessing means for calculating a reference 
error associated with each reference signa- 
ture, each reference error representing a 
mismatch between the selected measures 
as evaluated on that reference signature 
and the same measures as averaged over 
the reference set; and 

I) the system further comprises digital pro- 
cessing means for determining the thresh- 
old value based on the reference errors. 

10. The system of claim 9, wherein for the i-th 
entrant and the j-th measure, the average mea- 
sure is the statistical mean, denoted Uy, of that 
measure over the reference set; the deviation 
Is the standard deviation, denoted a^, of that 
measure over the reference set; and the 
means for calculating entrant error and refer- 
ence error comprise means for evaluating the 
expression 



Ei = [ Z((Mij-Hij)/ay)M*^ 
j = i 



where Ni denotes the total number of mea- 
sures selected for the i-th entrant; the summa- 
tion is carried out over the selected measures; 
if entrant error is being calculated, Ej denotes 
the entrant error and M|j denotes the j-th one 
of the selected measures evaluated over an 
entrant signature of the i-th entrant; and if 
reference error is being calculated, Ei denotes 
the reference error and is calculated for each 
reference signature as if that signature were an 
entrant signature. 

11. The system of claim 10, wherein the threshold- 
determining means comprise means for iden- 
tifying the largest reference error and for se- 
lecting a threshold value which is greater than 
or equal to the largest reference error. 

12. The system of claim 9. further comprising: 

a) means for digitally storing, on a storage 
medium that is local with respect to at least 
one entrant, data which comprise: the iden- 
tities of the selected measures, the aver- 
ages and deviations of the selected mea- 
sures over the reference set, and the 
threshold value; and 

b) means for reading the locally stored data. 

13. In a communications network, a nrtethod for 



controlling access to a system such that when 
an entrant signature is accepted, responsive 
means are activated, with the result that ac- 
cess to the system becomes available, the 
5 method comprising: 

a) receiving from input means, and digitally 
recording, at least one entrant signature; 

b) evaluating, on the entrant signature, at 
least three spatial and/or dynamic proper- 

70 ties, to be referred to as "measures", the at 

least three measures constituting a measure 
set; 

c) reading reference data from a digital stor- 
age medium that is local with respect to at 

15 least one entrant, the reference data includ- 

ing the mean and deviation of each mea- 
sure as evaluated over a reference set 
which comprises a multiplicity of reference 
signatures; 

20 d) comparing the entrant signature to the 

reference data by a process that comprises 
calculating at least one entrant error, the 
entrant error representing a mismatch be- 
tween the measures as evaluated on the 

25 entrant signature and the same measures 

as averaged over the reference set; and 

e) comparing the entrant error to a thresh- 
old value such that the entrant signature is 
accepted if the entrant error is less than, or 

30 fess than or equal to, the threshold value, 

CHARACTERIZED IN THAT 

f) the threshold value is based on at least 
one reference error, each reference error 
being defined as a mismatch between the 

35 measures, as evaluated on one of the refer- 

ence signatures, and the same measures as 
averaged over the reference set; 

g) the measure set is a proper subset of a 
measure superset which contains at least 

40 four measures, the measure set consisting 

of the at least three measures, selected 
from the superset, which have the smallest 
deviations over the set of reference signa- 
tures: and 

45 h) the reference data further include the 

threshold value, and further include informa- 
tion which identifies the selected at least 
three measures. 

50 14. In a communications network, an access-con- 
trolled system which includes responsive 
means that are activated when an entrant sig- 
nature is accepted, with the result that access 
to the system is made available, the system 
55 further comprising: 

a) means for receiving from input means, 
and digitally recording, at least one entrant 
signature; 
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b) digital processing means for evaluating, 
on the entrant signature, at least three spa- 
tial and/or dynamic properties, to be re- 
ferred to as "measures", the at least three 
measures constituting a measure set; s 

c) means for reading reference data from a 
digital storage medium that is local with 
respect to at least one entrant, the refer- 
ence data including the mean and deviation 

of each measure as evaluated over a refer- io 
ence set which comprises a multiplicity of 
reference signatures; 

d) digital processing means for comparing 
the entrant signature to the reference data 

by a process that comprises calculating at is 
least one entrant error, the entrant error 
representing a mismatch between the mea- 
sures as evaluated on the entrant signature 
and the same measures as evaluated over 
the reference set; and 20 

e) digital processing means for comparing 
the entrant error to a threshold value such 
that the entrant signature is accepted if the 
entrant error is less than, or less than or 
equal to, the threshold value, and for ac- 25 
tivating the responsive means if the entrant 
signature is accepted, CHARACTERIZED IN 
THAT 

f) the threshold value is based on at least 

one reference error, each reference error 30 
being defined as a mismatch between the 
measures, as calculated on one of the refer- 
ence signatures, and the same measures as 
averaged over the reference set; 

g) the measure set is a proper subset of a 35 
measure superset which contains at least 

four measures, the measure set consisting 
of the at least three measures, selected 
from the superset, which have the smallest 
deviations over the set of reference signa- 40 
tures; and 

h) the reference data further include the 
threshold value, and still further include in- 
formation which identifies, the selected at 
least three measures. 45 
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